AP Cybersecurity Drill 22: Classifying Sensitive Records

Question 1. Set 1 (patient charts) is best classified as which type of data?

• A) Financial data, because the chart can later affect what a patient ends up being billed for each visit
• B) Protected health information, because it ties an identifiable patient to a diagnosis and treatment ✓
• C) Directory data, because a chart simply lists a patient's name the same way a contact list lists a name
• D) Education record data, because the clinic also trains interns who read patient charts while they learn

Explanation: Choice B is correct. Protected health information is individually identifiable information about a person's health, care, or treatment; a chart linking a named patient to diagnoses and medications fits squarely. Choice A is incorrect because the chart holds clinical, not payment, data. Choice C is incorrect because a name alongside a diagnosis is far more sensitive than a directory entry. Choice D is incorrect because the chart is about a patient's health, not a student's schooling, even though interns may study it.

Question 2. Looking only at the field type shown, not broader sector-specific legal rules, the most specific classification of Set 2 is:

• A) Health data, because the card happened to be used to pay a clinic that provides medical care to patients
• B) Directory data, because the cardholder name also appears in the clinic's general staff contact records
• C) Education data, because the same person might also enroll later in the clinic's intern training program
• D) Payment-card data, which is financial data, since the number and expiry let someone defraud the holder ✓

Explanation: Choice D is correct. A credit-card number with its expiration date is payment-card data, a category of financial data, and it carries direct fraud risk if exposed. Choice A is incorrect because the card data itself is financial, not clinical, even when collected at a clinic. Choice B is incorrect because a directory holds low-sensitivity contact details, not payment cards. Choice C is incorrect because nothing here concerns a school record.

Question 3. Which record set carries the LEAST sensitivity and the lightest handling duty?

• A) Set 3, the staff directory, because work name, work email, and extension are routine business-contact details ✓
• B) Set 1, the patient charts, because clinicians already read through them every day during normal appointments
• C) Set 2, the billing file, because the card networks, rather than the clinic itself, absorb the cost of any fraud
• D) Set 4, the intern records, because course grades feel less serious than a medical diagnosis to most readers

Explanation: Choice A is correct. A staff directory of work names, work emails, and office extensions is ordinary business-contact information and is the least sensitive set here. Choice B is incorrect because routine clinician access does not lower how sensitive health data is. Choice C is incorrect because card data is highly sensitive regardless of who bears fraud losses. Choice D is incorrect because student grades and enrollment are still student/education record data, not low-sensitivity data.

Question 4. An auditor reviewing Set 4 wants to confirm it includes academic-performance information. Which single field in Set 4 most directly confirms that?

• A) Student name, since a person's name appears in nearly every record set the clinic keeps on file
• B) Enrollment status, since it shows whether someone is currently in the program but not how they performed
• C) A timestamp, since every record set the clinic stores is automatically stamped with a creation date
• D) Course grades, since grades are academic performance information tied to a named student's schooling ✓

Explanation: Choice D is correct. Course grades are academic performance information tied to a named student, which is exactly what the question asks the auditor to confirm. Choice A is incorrect because a name appears in every set and reflects identity, not academic performance. Choice B is incorrect because enrollment status is student/education record context but records a standing, not a measure of performance. Choice C is incorrect because a timestamp is metadata present on many records and says nothing about academic performance.

Question 5. Given the mix of data types, what is the best overall protection approach for these four sets?

• A) Store all four sets together in one open shared folder so any staff member can quickly find any record when asked
• B) Apply controls by class: encrypt the health, card, and student data; allow routine internal access to the directory ✓
• C) Protect only the billing file, since card data is really the single set that could ever lead to a direct financial loss
• D) Delete the staff directory first, since it is arguably the only set the clinic does not strictly need to keep on hand

Explanation: Choice B is correct. Matching the strength of controls to each data class, with tight access and encryption for the sensitive sets and routine internal access only for the low-sensitivity directory, applies protection in proportion to risk. Choice A is incorrect because one open folder ignores the differing sensitivity and over-exposes protected data. Choice C is incorrect because health and student records also require protection, not just card data. Choice D is incorrect because deleting the directory is unjustified and leaves the sensitive sets unaddressed.